[clamav-users] Clamav found in php files Archive.Test.Agent2-9953724-0

[G.W. Haywood]

Hi there,

On Fri, 24 Jun 2022, Cyrille37 wrote:

> I don't understand why, but it appends this morning on already existed files 
> (in the wp-cli cache folder) :
>
> Start Date: 2022:06:24 12:15:01
> End Date:   2022:06:24 12:15:17
> /home/caf37-pt/.wp-cli/cache/core/wordpress-5.8.3-fr_FR.zip: 
> Archive.Test.Agent2-9953724-0 FOUND
> ...
> I could not find on the web some discussions about 
> "Archive.Test.Agent2-9953724-0" except this one
> https://answers.sap.com/questions/13665326/upload-application-content-failed-malware-detected.html

The signature is mentioned in this morning's automated email from the
ClamAV signatures database update process.

I suspect that you're seeing a false positive, that's always a risk
with new or updated signatures.

Perhaps you can upload one of the flagged files to e.g. Jotti's Virus
Scan or VirusTotal to see what a few other scanners make of it.

-- 

73,
Ged.